signal-cli from scratch on an ARM64 Pi, an agent runtime built from source for the Signal channel, and a read-only security model enforced in layers. Everything needed to rebuild it, including every trap.